CVE-2006-1076

Invision Power Board 2.1.5 - SQL Injection via st Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-1076. PoCs published by Mr.SNAKE.

AI-analyzed exploit summary The provided text describes an SQL injection vulnerability in Invision Power Board, but it is noted that this issue is not a vulnerability and the BID is retired. The example URL shows a potential SQL injection vector via the 'st' parameter.

Description

SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board (IPB) 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Mr.SNAKE · textwebappsphp
https://www.exploit-db.com/exploits/27361

The provided text describes an SQL injection vulnerability in Invision Power Board, but it is noted that this issue is not a vulnerability and the BID is retired. The example URL shows a potential SQL injection vector via the 'st' parameter.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Theoretical
Target: Invision Power Board
No auth needed
Prerequisites: Access to the target application URL
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25254
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/426875/100/0/threaded
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16971
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/430357/100/0/threaded

Scores

EPSS 0.0109
EPSS Percentile 62.0%

Details

Status published
Products (1)
invision_power_services/invision_power_board 2.1.5
Published Mar 09, 2006
Tracked Since Feb 18, 2026